CVE-2026-5302: Permissive Cross-domain Policy with Untrusted Domains in coolercontrold

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-08 · updated 2026-10-23
Weakness: CWE-942

Description

CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites

Affected products

coolercontrold: before 4.0.0 — fixed in 4.0.0

How to fix

Upgrade to a fixed version: coolercontrold 4.0.0. Check the vendor advisory for mitigations.

References

https://gitlab.com/coolercontrol/coolercontrol/-/blob/2.0.0/coolercontrold/src/api/mod.rs?ref_type=tags#L374
https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0

Get alerted when CVE-2026-5302 or the next vulnerability affects your stack